<html>
<head><meta charset="utf-8"><title>RFC: Stability Declaration Traits · project-safe-transmute · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/index.html">project-safe-transmute</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html">RFC: Stability Declaration Traits</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="204000394"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204000394" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204000394">(Jul 15 2020 at 19:19)</a>:</h4>
<p>If you like type puzzles, you might like thinking about the finer design details of the stability declaration traits. This is the problem statement:</p>
<blockquote>
<p>Since the soundness and safety of a transmutation is affected by the layouts of the source and destination types, changes to those types' layouts may cause code which previously compiled to produce errors. In other words, transmutation causes a type's layout to become part of that type's API for the purposes of SemVer stability.</p>
<p>The question is, then: <em>how can the author of a type reason about transmutations they did not write, from-or-to types they did not write?</em></p>
</blockquote>
<p>We have an elegant solution, but the finer details of it need to be explored: <a href="https://hackmd.io/anvM3Zy1QSi2bVPQiAK5eg#When-is-a-transmutation-stable">https://hackmd.io/anvM3Zy1QSi2bVPQiAK5eg#When-is-a-transmutation-stable</a></p>



<a name="204011238"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204011238" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204011238">(Jul 15 2020 at 20:51)</a>:</h4>
<p>well as soon as you put a non-rust repr, you're stabilized. It should be that simple</p>



<a name="204012495"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204012495" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204012495">(Jul 15 2020 at 21:02)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> I got in an argument with someone about that a while ago because I thought the same.  Unfortunately, <code>#[repr(C)]</code> doesn't formally imply much in the way of semver stability. It merely indicates the type will be laid out in memory using a particular algorithm. It <em>might</em> imply that you won't remove <code>#[repr(C)]</code>, but that's not well-articulated. The presence or lack of <code>#[repr(C)]</code> isn't clearly reflected in rustdoc, so plenty of people assume it doesn't connote any semver obligations.</p>
<p>And I don't know anyone who thinks it connotes that going from this:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="p">(</span><span class="k">pub</span><span class="w"> </span><span class="kt">u8</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>...to this:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="p">(</span><span class="k">pub</span><span class="w"> </span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="k">pub</span><span class="w"> </span><span class="kt">u8</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>...is a breaking change, but for transmutations it might be! The first <code>Foo</code> can be instantiated with a transmutation from <code>u8</code>, the  second <code>Foo</code> cannot because its size changed.</p>



<a name="204012709"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204012709" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204012709">(Jul 15 2020 at 21:04)</a>:</h4>
<p>repr(C) is reflected in rustdoc</p>



<a name="204012761"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204012761" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204012761">(Jul 15 2020 at 21:04)</a>:</h4>
<p>basically whoever you argued with is very wrong</p>



<a name="204012769"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204012769" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204012769">(Jul 15 2020 at 21:04)</a>:</h4>
<p>and you were right</p>



<a name="204013026"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204013026" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204013026">(Jul 15 2020 at 21:07)</a>:</h4>
<p>On <a href="https://docs.rs/nalgebra/0.21.1/nalgebra/base/struct.Matrix.html">this page</a>, it's obscured by two hidden-by-default layers:</p>
<ol>
<li>First click 'Show Declaration'</li>
<li>Then, click 'Expand Attributes'</li>
</ol>



<a name="204013770"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204013770" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204013770">(Jul 15 2020 at 21:13)</a>:</h4>
<p>well i never said that rustdoc had useful defaults ;_;</p>



<a name="204013920"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204013920" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204013920">(Jul 15 2020 at 21:14)</a>:</h4>
<p>anyway, adding a public field is a breaking change already because it messes up pattern matching</p>



<a name="204014236"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204014236" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204014236">(Jul 15 2020 at 21:16)</a>:</h4>
<p>Let me amend my example, then:</p>
<p>Going from this:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="p">(</span><span class="k">pub</span><span class="w"> </span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="kt">u8</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>...to this:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="p">(</span><span class="k">pub</span><span class="w"> </span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="kt">u16</span><span class="p">);</span><span class="w"></span>
</code></pre></div>



<a name="204014852"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204014852" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204014852">(Jul 15 2020 at 21:22)</a>:</h4>
<p>I'd still call it a breaking change because of the size/align change. Now it's maybe a "small" break, and to most people it's even a "source compatible" change, but nonetheless it is a break.</p>



<a name="204014927"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204014927" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204014927">(Jul 15 2020 at 21:22)</a>:</h4>
<p>maybe I'm draconian</p>



<a name="204014993"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204014993" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204014993">(Jul 15 2020 at 21:23)</a>:</h4>
<p>So, yeah, in that example, you can at least observe that a change happened in safe code (via <code>size_of</code> and <code>align_of</code>). Here's an example where you can't:</p>
<p>Going from this:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="p">(</span><span class="kt">u16</span><span class="p">,</span><span class="w"> </span><span class="kt">u8</span><span class="p">,</span><span class="w"> </span><span class="kt">u8</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>...to this:</p>
<div class="codehilite"><pre><span></span><code><span class="cp">#[repr(C)]</span><span class="w"></span>
<span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="p">(</span><span class="kt">u16</span><span class="p">,</span><span class="w"> </span><span class="kt">u8</span><span class="p">);</span><span class="w"></span>
</code></pre></div>


<p>is a breaking change. The first <code>Foo</code> can be safely transmuted into <code>[u8; 4]</code>; the second <code>Foo</code> cannot because doing so would expose padding bytes as initialized memory.</p>



<a name="204016472"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204016472" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204016472">(Jul 15 2020 at 21:38)</a>:</h4>
<p>I'm not all that opposed to using <code>#[repr(C)]</code> as an indicator of a blanket stability guarantee, but:</p>
<ul>
<li>It's not clear if people (such as my friend) have generally understood they were making wide-ranging stability guarantees when they used <code>#[repr(C)]</code></li>
<li><a href="#narrow/stream/216762-project-safe-transmute/topic/typic/near/201165897">Some people</a> think that there should be more than merely <code>#[repr(C)]</code> standing between you and a transmute.</li>
<li><a href="#narrow/stream/216762-project-safe-transmute/topic/Transmutability.20Intrinsic/near/202712834">Other people</a> want to  provide stability guarantees on a finer basis than all-or-nothing.</li>
</ul>



<a name="204037202"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/RFC%3A%20Stability%20Declaration%20Traits/near/204037202" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/RFC.3A.20Stability.20Declaration.20Traits.html#204037202">(Jul 16 2020 at 02:14)</a>:</h4>
<p>tfw you click the link and it turns out you're the "some people".</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>